fix(docker): migrate containers to port 8080

[JoshuaLicense]

Description

Migrate to port 8080 instead of 80. Ports below 1024 require root access to listen.

This is required to run ECS containers as a non-root user as per the best practice.

Before submitting (or marking as "ready for review")

• Does the pull request title follow the conventional commit specification?
• Have you performed a self-review of the code
• Have you have added tests that prove the fix or feature is effective and working
• Did you make sure to update any documentation relating to this change?

[github-actions]

Terraform plan for environment: int

Commit: fa6fe36

API version: fa6fe36
Selfserve version: fa6fe36
Internal version: fa6fe36

Plan summary

0 to add, 0 to change, 0 to destroy

---

Show full plan

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

[github-actions]

Terraform plan for environment: dev

Commit: fa6fe36

API version: fa6fe36
Selfserve version: fa6fe36
Internal version: fa6fe36

Plan summary

3 to add, 3 to change, 3 to destroy

🆕 Creates

module.service.module.ecs_service["api"].aws_ecs_task_definition.this[0]
module.service.module.ecs_service["internal"].aws_ecs_task_definition.this[0]
module.service.module.ecs_service["selfserve"].aws_ecs_task_definition.this[0]

🗑️ Deletes

module.service.module.ecs_service["api"].aws_iam_role_policy.tasks[0]
module.service.module.ecs_service["internal"].aws_iam_role_policy.tasks[0]
module.service.module.ecs_service["selfserve"].aws_iam_role_policy.tasks[0]

📖 Reads

module.service.module.ecs_service["api"].data.aws_ecs_task_definition.this[0]
module.service.module.ecs_service["internal"].data.aws_ecs_task_definition.this[0]
module.service.module.ecs_service["selfserve"].data.aws_ecs_task_definition.this[0]

🔄 Updates

module.service.module.ecs_service["api"].aws_ecs_service.this[0]
module.service.module.ecs_service["internal"].aws_ecs_service.this[0]
module.service.module.ecs_service["selfserve"].aws_ecs_service.this[0]

---

Show full plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy
+/- create replacement and then destroy
 <= read (data resources)

Terraform will perform the following actions:

  # module.service.module.ecs_service["api"].data.aws_ecs_task_definition.this[0] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_ecs_task_definition" "this" {
      + arn                  = (known after apply)
      + arn_without_revision = (known after apply)
      + execution_role_arn   = (known after apply)
      + family               = (known after apply)
      + id                   = (known after apply)
      + network_mode         = (known after apply)
      + revision             = (known after apply)
      + status               = (known after apply)
      + task_definition      = "vol-app-dev-api-service"
      + task_role_arn        = (known after apply)
    }

  # module.service.module.ecs_service["api"].aws_ecs_service.this[0] will be updated in-place
  ~ resource "aws_ecs_service" "this" {
      ~ enable_execute_command             = true -> false
        id                                 = "arn:aws:ecs:eu-west-1:054614622558:service/vol-app-dev-api-cluster/vol-app-dev-api-service"
        name                               = "vol-app-dev-api-service"
        tags                               = {}
      ~ task_definition                    = "vol-app-dev-api-service:11" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.service.module.ecs_service["api"].aws_ecs_task_definition.this[0] must be replaced
+/- resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:eu-west-1:054614622558:task-definition/vol-app-dev-api-service:11" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-west-1:054614622558:task-definition/vol-app-dev-api-service" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ image                  = "054614622558.dkr.ecr.eu-west-1.amazonaws.com/vol-app/api:test" -> "054614622558.dkr.ecr.eu-west-1.amazonaws.com/vol-app/api:fa6fe36"
                  ~ linuxParameters        = {
                      ~ initProcessEnabled = true -> false
                    }
                    name                   = "api"
                  ~ user                   = "www-data" -> "0"
                    # (16 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ id                       = "vol-app-dev-api-service" -> (known after apply)
      ~ revision                 = 11 -> (known after apply)
      - tags                     = {} -> null
      ~ tags_all                 = {} -> (known after apply)
        # (11 unchanged attributes hidden)

      ~ runtime_platform {
          ~ cpu_architecture        = "ARM64" -> "X86_64" # forces replacement
            # (1 unchanged attribute hidden)
        }
    }

  # module.service.module.ecs_service["api"].aws_iam_role_policy.tasks[0] will be destroyed
  # (because index [0] is out of range for count)
  - resource "aws_iam_role_policy" "tasks" {
      - id          = "vol-app-dev-api-service-20240418150301374200000005:vol-app-dev-api-service-20240430142821580100000003" -> null
      - name        = "vol-app-dev-api-service-20240430142821580100000003" -> null
      - name_prefix = "vol-app-dev-api-service-" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "ssmmessages:OpenDataChannel",
                          - "ssmmessages:OpenControlChannel",
                          - "ssmmessages:CreateDataChannel",
                          - "ssmmessages:CreateControlChannel",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "ECSExec"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - role        = "vol-app-dev-api-service-20240418150301374200000005" -> null
    }

  # module.service.module.ecs_service["internal"].data.aws_ecs_task_definition.this[0] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_ecs_task_definition" "this" {
      + arn                  = (known after apply)
      + arn_without_revision = (known after apply)
      + execution_role_arn   = (known after apply)
      + family               = (known after apply)
      + id                   = (known after apply)
      + network_mode         = (known after apply)
      + revision             = (known after apply)
      + status               = (known after apply)
      + task_definition      = "vol-app-dev-internal-service"
      + task_role_arn        = (known after apply)
    }

  # module.service.module.ecs_service["internal"].aws_ecs_service.this[0] will be updated in-place
  ~ resource "aws_ecs_service" "this" {
      ~ enable_execute_command             = true -> false
        id                                 = "arn:aws:ecs:eu-west-1:054614622558:service/vol-app-dev-internal-cluster/vol-app-dev-internal-service"
        name                               = "vol-app-dev-internal-service"
        tags                               = {}
      ~ task_definition                    = "vol-app-dev-internal-service:5" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.service.module.ecs_service["internal"].aws_ecs_task_definition.this[0] must be replaced
+/- resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:eu-west-1:054614622558:task-definition/vol-app-dev-internal-service:5" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-west-1:054614622558:task-definition/vol-app-dev-internal-service" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ image                  = "054614622558.dkr.ecr.eu-west-1.amazonaws.com/vol-app/internal:b668e11" -> "054614622558.dkr.ecr.eu-west-1.amazonaws.com/vol-app/internal:fa6fe36"
                  ~ linuxParameters        = {
                      ~ initProcessEnabled = true -> false
                    }
                    name                   = "internal"
                  ~ portMappings           = [
                      ~ {
                          ~ containerPort = 80 -> 8080
                          ~ hostPort      = 80 -> 8080
                            name          = "http"
                            # (1 unchanged attribute hidden)
                        },
                    ]
                  ~ user                   = "www-data" -> "0"
                    # (15 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ id                       = "vol-app-dev-internal-service" -> (known after apply)
      ~ revision                 = 5 -> (known after apply)
      - tags                     = {} -> null
      ~ tags_all                 = {} -> (known after apply)
        # (11 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.service.module.ecs_service["internal"].aws_iam_role_policy.tasks[0] will be destroyed
  # (because index [0] is out of range for count)
  - resource "aws_iam_role_policy" "tasks" {
      - id          = "vol-app-dev-internal-service-20240419132422667300000005:vol-app-dev-internal-service-20240430142821579200000001" -> null
      - name        = "vol-app-dev-internal-service-20240430142821579200000001" -> null
      - name_prefix = "vol-app-dev-internal-service-" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "ssmmessages:OpenDataChannel",
                          - "ssmmessages:OpenControlChannel",
                          - "ssmmessages:CreateDataChannel",
                          - "ssmmessages:CreateControlChannel",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "ECSExec"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - role        = "vol-app-dev-internal-service-20240419132422667300000005" -> null
    }

  # module.service.module.ecs_service["selfserve"].data.aws_ecs_task_definition.this[0] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_ecs_task_definition" "this" {
      + arn                  = (known after apply)
      + arn_without_revision = (known after apply)
      + execution_role_arn   = (known after apply)
      + family               = (known after apply)
      + id                   = (known after apply)
      + network_mode         = (known after apply)
      + revision             = (known after apply)
      + status               = (known after apply)
      + task_definition      = "vol-app-dev-selfserve-service"
      + task_role_arn        = (known after apply)
    }

  # module.service.module.ecs_service["selfserve"].aws_ecs_service.this[0] will be updated in-place
  ~ resource "aws_ecs_service" "this" {
      ~ enable_execute_command             = true -> false
        id                                 = "arn:aws:ecs:eu-west-1:054614622558:service/vol-app-dev-selfserve-cluster/vol-app-dev-selfserve-service"
        name                               = "vol-app-dev-selfserve-service"
        tags                               = {}
      ~ task_definition                    = "vol-app-dev-selfserve-service:5" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.service.module.ecs_service["selfserve"].aws_ecs_task_definition.this[0] must be replaced
+/- resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:eu-west-1:054614622558:task-definition/vol-app-dev-selfserve-service:5" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-west-1:054614622558:task-definition/vol-app-dev-selfserve-service" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ image                  = "054614622558.dkr.ecr.eu-west-1.amazonaws.com/vol-app/selfserve:b668e11" -> "054614622558.dkr.ecr.eu-west-1.amazonaws.com/vol-app/selfserve:fa6fe36"
                  ~ linuxParameters        = {
                      ~ initProcessEnabled = true -> false
                    }
                    name                   = "selfserve"
                  ~ portMappings           = [
                      ~ {
                          ~ containerPort = 80 -> 8080
                          ~ hostPort      = 80 -> 8080
                            name          = "http"
                            # (1 unchanged attribute hidden)
                        },
                    ]
                  ~ user                   = "www-data" -> "0"
                    # (15 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ id                       = "vol-app-dev-selfserve-service" -> (known after apply)
      ~ revision                 = 5 -> (known after apply)
      - tags                     = {} -> null
      ~ tags_all                 = {} -> (known after apply)
        # (11 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.service.module.ecs_service["selfserve"].aws_iam_role_policy.tasks[0] will be destroyed
  # (because index [0] is out of range for count)
  - resource "aws_iam_role_policy" "tasks" {
      - id          = "vol-app-dev-selfserve-service-20240419132422871500000008:vol-app-dev-selfserve-service-20240430142821579400000002" -> null
      - name        = "vol-app-dev-selfserve-service-20240430142821579400000002" -> null
      - name_prefix = "vol-app-dev-selfserve-service-" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "ssmmessages:OpenDataChannel",
                          - "ssmmessages:OpenControlChannel",
                          - "ssmmessages:CreateDataChannel",
                          - "ssmmessages:CreateControlChannel",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "ECSExec"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - role        = "vol-app-dev-selfserve-service-20240419132422871500000008" -> null
    }

Plan: 3 to add, 3 to change, 6 to destroy.